Windows Event ID 1102 – Microsoft-Windows-Eventlog: Security Log Cleared

Open Event Viewer and navigate to examine the Event ID 1102 details:

1. Press Windows + R, type eventvwr.msc, and press Enter
2. Navigate to Windows Logs → Security
3. Filter the log for Event ID 1102: Right-click Security → Filter Current Log
4. Enter 1102 in the Event IDs field and click OK
5. Double-click the Event ID 1102 entry to view detailed information
6. Review the General tab for user account, timestamp, and session details
7. Check the Details tab for raw XML data including SID and logon information

Use PowerShell to retrieve and analyze Event ID 1102 occurrences:

# Get all Event ID 1102 entries from Security log
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102} -MaxEvents 50

# Get detailed information with formatted output
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102} | 
    Select-Object TimeCreated, Id, LevelDisplayName, Message | 
    Format-Table -AutoSize

# Extract user information from Event ID 1102
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102} | 
    ForEach-Object {
        $xml = [xml]$_.ToXml()
        [PSCustomObject]@{
            TimeCreated = $_.TimeCreated
            UserSID = $xml.Event.EventData.Data[0].'#text'
            AccountName = $xml.Event.EventData.Data[1].'#text'
            AccountDomain = $xml.Event.EventData.Data[2].'#text'
            LogonID = $xml.Event.EventData.Data[3].'#text'
        }
    }

This PowerShell approach provides programmatic access to Event ID 1102 data for automated monitoring and reporting.

Investigate the complete session context by correlating Event ID 1102 with related logon events:

# First, get the Logon ID from Event ID 1102
$logClearEvent = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102} -MaxEvents 1
$xml = [xml]$logClearEvent.ToXml()
$logonID = $xml.Event.EventData.Data[3].'#text'

# Find corresponding logon events (4624) with the same Logon ID
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} | 
    Where-Object {
        $eventXml = [xml]$_.ToXml()
        $eventXml.Event.EventData.Data | 
            Where-Object {$_.Name -eq 'TargetLogonId' -and $_.'#text' -eq $logonID}
    } | Select-Object TimeCreated, Message

# Check for any suspicious activities in the same timeframe
$timeRange = $logClearEvent.TimeCreated.AddHours(-2)
Get-WinEvent -FilterHashtable @{
    LogName='Security'
    StartTime=$timeRange
    EndTime=$logClearEvent.TimeCreated
    Id=4625,4648,4672
} | Format-Table TimeCreated, Id, Message -AutoSize

Set up comprehensive monitoring for Event ID 1102 to detect future occurrences:

1. Enable advanced security auditing through Group Policy:
   • Open gpedit.msc (Local Group Policy Editor)
   • Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration
   • Expand System Audit Policies → Policy Change
   • Double-click Audit Policy Change and enable Success and Failure
2. Create a scheduled task to monitor for Event ID 1102:

   # Create XML for scheduled task trigger
   $taskXML = @'
   
   
     
       
         <QueryList><Query Id="0" Path="Security"><Select Path="Security">*[System[EventID=1102]]</Select></Query></QueryList>
       
     
     
       
         powershell.exe
         -Command "Send-MailMessage -To 'admin@company.com' -From 'security@company.com' -Subject 'ALERT: Security Log Cleared' -Body 'Event ID 1102 detected on $(hostname)' -SmtpServer 'mail.company.com'"
       
     
   
   '@
   
   # Register the scheduled task
   Register-ScheduledTask -TaskName "SecurityLogClearAlert" -Xml $taskXML

Perform advanced forensic analysis when Event ID 1102 indicates potential security incidents:

1. Check for backed-up event logs before the clearing occurred:

   # Look for archived event log files
   Get-ChildItem -Path "C:\Windows\System32\winevt\Logs\" -Filter "Archive-Security-*.evtx" | 
       Sort-Object LastWriteTime -Descending
   
   # If backup logs exist, analyze them
   $backupLog = "C:\Windows\System32\winevt\Logs\Archive-Security-2026-03-17-12-00-00-000.evtx"
   if (Test-Path $backupLog) {
       Get-WinEvent -Path $backupLog -FilterHashtable @{Id=4624,4625,4648,4672} | 
           Where-Object {$_.TimeCreated -gt (Get-Date).AddDays(-1)} | 
           Format-Table TimeCreated, Id, Message -AutoSize
   }

2. Examine Windows Security log registry settings:

   # Check Security log configuration
   Get-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Security" | 
       Select-Object MaxSize, Retention, AutoBackupLogFiles
   
   # Verify log file permissions
   Get-Acl "C:\Windows\System32\winevt\Logs\Security.evtx" | Format-List

3. Review system file integrity and recent changes:

   # Check for recent system changes
   Get-WinEvent -FilterHashtable @{LogName='System'; Id=7034,7035,7036} | 
       Where-Object {$_.TimeCreated -gt (Get-Date).AddHours(-4)} | 
       Format-Table TimeCreated, Id, Message -AutoSize
   
   # Verify critical system files
   sfc /verifyonly